Add a template to build the image string

This also allows to use image digest as a version

Signed-off-by: Marco Franssen <[email protected]>

charts/spire/templates/_helpers.tpl

@@ -120,3 +120,15 @@ Create the name of the service account to use
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}
 {{- end }}
+
+{{- define "spire.image" -}}
+{{- if eq (substr 0 7 .image.version) "sha256:" -}}
+{{- printf "%s/%s@%s" .image.registry .image.repository .image.version -}}
+{{- else if .appVersion -}}
+{{- printf "%s/%s:%s" .image.registry .image.repository (default .appVersion .image.version) -}}
+{{- else if .image.version -}}
+{{- printf "%s/%s:%s" .image.registry .image.repository .image.version -}}
+{{- else -}}
+{{- printf "%s/%s" .image.registry .image.repository -}}
+{{- end -}}
+{{- end }}

charts/spire/templates/agent-daemonset.yaml

@@ -25,7 +25,8 @@ spec:
           # This is a small image with wait-for-it, choose whatever image
           # you prefer that waits for a service to be up. This image is built
           # from https://github.com/lqhl/wait-for-it
-          image: gcr.io/spiffe-io/wait-for-it:latest
+          image: {{ template "spire.image" .Values.waitForIt }}
+          imagePullPolicy: {{ .Values.waitForIt.image.pullPolicy }}
           args: ["-t", "30", "{{ include "spire.fullname" . }}-server:8081"]
       {{- with .Values.agent.nodeSelector }}
       nodeSelector:
@@ -33,7 +34,8 @@ spec:
       {{- end }}
       containers:
         - name: {{ .Chart.Name }}-agent
-          image: "{{ .Values.agent.image.repository }}:{{ .Values.agent.image.tag | default .Chart.AppVersion }}"
+          image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.agent.image) }}
+          imagePullPolicy: {{ .Values.agent.image.pullPolicy }}
           args: ["-config", "/run/spire/config/agent.conf"]
           volumeMounts:
             - name: spire-config
@@ -63,8 +65,8 @@ spec:
             {{- toYaml .Values.agent.resources | nindent 12 }}
         # This is the container which runs the SPIFFE CSI driver.
         - name: spiffe-csi-driver
-          image: {{ .Values.csiDriver.image.repository}}:{{ .Values.csiDriver.image.tag}}
-          imagePullPolicy: {{ .Values.csiDriver.image.pullPolicy}}
+          image: {{ template "spire.image" .Values.csiDriver }}
+          imagePullPolicy: {{ .Values.csiDriver.image.pullPolicy }}
           args: [
             "-workload-api-socket-dir", "/spire-agent-socket",
             "-csi-socket-path", "/spiffe-csi/csi.sock",
@@ -98,7 +100,7 @@ spec:
         # of all the little details required to register a CSI driver with
         # the kubelet.
         - name: node-driver-registrar
-          image: {{ .Values.nodeDriverRegistrar.image.repository }}:{{ .Values.nodeDriverRegistrar.image.tag }}
+          image: {{ template "spire.image" .Values.nodeDriverRegistrar }}
           imagePullPolicy: {{ .Values.nodeDriverRegistrar.image.pullPolicy }}
           args: [
             "-csi-address", "/spiffe-csi/csi.sock",

charts/spire/templates/oidc-deployment.yaml

@@ -35,7 +35,7 @@ spec:
         - name: spire-oidc
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.oidc.image.repository }}:{{ .Values.oidc.image.tag | default .Chart.AppVersion }}"
+          image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.oidc.image) }}
           imagePullPolicy: {{ .Values.oidc.image.pullPolicy }}
           args:
             - -config
@@ -71,8 +71,8 @@ spec:
         - name: nginx
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.oidc.insecureScheme.nginx.repository }}:{{ .Values.oidc.insecureScheme.nginx.tag }}"
-          imagePullPolicy: {{ .Values.oidc.insecureScheme.nginx.pullPolicy }}
+          image: {{ template "spire.image" .Values.oidc.insecureScheme.nginx }}
+          imagePullPolicy: {{ .Values.oidc.insecureScheme.nginx.image.pullPolicy }}
           ports:
             - containerPort: 80
               name: http

charts/spire/templates/server-statefulset.yaml

@@ -40,7 +40,7 @@ spec:
         - name: {{ .Chart.Name }}-server
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.server.image.repository }}:{{ .Values.server.image.tag | default .Chart.AppVersion }}"
+          image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.server.image) }}
           imagePullPolicy: {{ .Values.server.image.pullPolicy }}
           args:
             - -config
@@ -80,7 +80,7 @@ spec:
         - name: {{ .Chart.Name }}-workload-registrar
           securityContext:
             {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.workloadRegistrar.image.repository }}:{{ .Values.workloadRegistrar.image.tag | default .Chart.AppVersion }}"
+          image: {{ template "spire.image" (dict "appVersion" $.Chart.AppVersion "image" .Values.workloadRegistrar.image) }}
           imagePullPolicy: {{ .Values.workloadRegistrar.image.pullPolicy }}
           args:
             - -config